# 21 - FTP

## <mark style="color:red;">Banner Grabbing</mark> <a href="#banner-grabbing" id="banner-grabbing"></a>

### <mark style="color:blue;">**Telnet**</mark>&#x20;

```sh
telnet 10.0.0.3 21
```

### <mark style="color:blue;">**Netcat**</mark>

```sh
nc -n 10.0.0.3 21
```

### <mark style="color:blue;">**NSE Script**</mark>

```sh
nmap -sV -script banner -p21 -Pn 10.0.0.3
```

### <mark style="color:blue;">**FTP**</mark>

```sh
ftp 10.0.0.3
```

## <mark style="color:red;">FTP Exploitation</mark> <a href="#ftp-exploits-search" id="ftp-exploits-search"></a>

### <mark style="color:blue;">Anonymous Login</mark> <a href="#anonymous-login" id="anonymous-login"></a>

Note: During the port scanning phase Nmap’s script scan (`-sC`), can be enabled to check for FTP Bounce and Anonymous Login.

Try anonymous login using `anonymous:anonymous` credentials.

```sh
ftp 10.0.0.3
…
Name (10.0.0.3:kali): anonymous
331 Please specify the password.
Password: [anonymous]
230 Login successful.
```

List **all** files in order.

```sh
ftp> ls -lat
200 PORT command successful. Consider using PASV.
150 Here comes the directory listing.
…
226 Directory send OK.
```

### <mark style="color:blue;">FTP Browser Client</mark> <a href="#ftp-browser-client" id="ftp-browser-client"></a>

{% hint style="info" %}
Due to its insecure nature, FTP support is being dropped by Firefox and Google Chrome.
{% endhint %}

Try accessing `ftp://user:pass@10.0.0.3` from your browser. If not credentials provided `anonymous:anonymous` is assumed.

### <mark style="color:blue;">Brute Forcing</mark> <a href="#brute-forcing" id="brute-forcing"></a>

Se [Brute Forcing SSH](#brute-forcing)

{% hint style="info" %}
SecLists includes a handy list of [FTP default credentials](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/ftp-betterdefaultpasslist.txt).
{% endhint %}

## <mark style="color:red;">Configuration files</mark> <a href="#configuration-files" id="configuration-files"></a>

It is important to examine these config files:

```
ftpusers
ftp.conf
proftpd.conf
```

## <mark style="color:red;">Other</mark> <a href="#miscellaneous" id="miscellaneous"></a>

### <mark style="color:blue;">Binary and ASCII</mark> <a href="#binary-and-ascii" id="binary-and-ascii"></a>

Binary and ASCII files have to be uploading using the `binary` or `ascii` mode respectively, otherwise, the file will become corrupted. Use the corresponding command to switch between modes.

### <mark style="color:blue;">Download all files from FTP</mark>

```bash
wget -m ftp://anonymous:anonymous@10.10.10.98 #Donwload all
wget -m --no-passive ftp://anonymous:anonymous@10.10.10.98 #Download all
```